无法摆脱ForbiddenError:无效的csrf令牌在express与csurf

我读了很多关于这个主题的帖子，但似乎没有一个帮助错误消息"ForbiddenError: invalid csrf token"我得到。

从下面的入口app.js文件中可以看到，我在session中设置了csrf值，然后可以在模板中使用它:

import * as express from "express"
import users from "./src/users/boundaries-users/users-boundaries"
import * as directory from "./src/directory/boudaries-directory/links-boudaries"
import * as comment from "./src/comments/boundaries-comments/comments-boundaries"
import admin from "./src/@admin/boundaries-admin/admin-boundaries"
import * as session from "express-session"
import Home from "./src/home/use-cases-home/home-case"
import * as email from "./src/utilities-global/email"
import * as csrf from "csurf"
let nodemailer = require( "nodemailer" )
let app = express()
/** Session */
app.use( session( { "secret": "taracebulba" } ) )
/*
 Middleware used to allow template system to acces session information. Must be placed between session and routes middlewares.
 http://expressjs.com/fr/api.html#res.locals and
 http://stackoverflow.com/questions/16823008/express-res-locals-somevariable-use-in-hbs-handlebars-template
 */
app.use( function( req, res, next ) {
    res.locals.session = req.session
    next()
} )

app.use( csrf() )
app.use( function( req, res, next ) {
    res.locals._csrf = req.csrfToken()
    next()
} )

// Console log sessions
app.use( function( req, res, next ) {
    console.log( req.session)
    next()
} )

/* ---------------------------------------------------------------------------------------------------------------*/
// Home url handling
/* ---------------------------------------------------------------------------------------------------------------*/
// Home
app.get( "/", ( req, res ) => {
    const url = "/"
    new Home( req, res ).homeDisplay( undefined, undefined, undefined, "isHome", url )
} )
// Home searched
app.get( "/from/:source/to/:target/:sorting", ( req, res ) => {
    const sourceLanguage = req.params.source
    const targetLanguage = req.params.target
    const sorting        = req.params.sorting
    const url            = req.url
    new Home( req, res ).homeDisplay( sourceLanguage, targetLanguage, sorting, "isNotHome", url )
} )
// Contact
app.get( "/contact", ( req, res ) => {
    res.render( "contact.ejs", {
        "data": {
            "pageTitle": "Contact us"
        }
    } )
} )

/* ---------------------------------------------------------------------------------------------------------------*/
// Routes
/* ---------------------------------------------------------------------------------------------------------------*/
app.use( "/users", users )
app.use( "/directory", directory.routerDirectory )
app.use( "/comment", comment.routerComments )
app.use( "/admin", admin )


/** Views */
app.set( "views", [
    __dirname + "/src/users/views-users",
    __dirname + "/src/directory/views-directory",
    __dirname + "/src/comments/views-comments",
    __dirname + "/src/views-global",
    __dirname + "/src/@admin/views-admin",
    __dirname + "/src/home/views-home"
] )
app.set( "view engine", "ejs" )
app.locals.moment = require( "moment" )

/** Static */
app.use( express.static( __dirname + "/src/@frontend" ) )

/** Handle uncought exception  */
process.on( "uncaughtException", function( er ) {
    const transporter = nodemailer.createTransport( email.smtpConfig )
    console.error( er.stack ) // [3]
    transporter.sendMail( {
        "from"   : "alerts@mycompany.com",
        "to"     : "******@gmail.com",
        "subject": er.message,
        "text"   : er.stack
    }, function( er ) {
        if ( er ) {
            console.error( er )
        }
        process.exit( 1 )
    } )
} )
app.listen( 3000, function() {
    console.log( "Example app listening on port 3000!" )
} )

我检查了会话，csrfsecret密钥在那里:

  Session {
  cookie: 
   { path: '/',
     _expires: null,
     originalMaxAge: null,
     httpOnly: true },
  csrfSecret: 'JcR1li3zf5bFXZg7fcYQbrz4' }

同样，在生成的模板中，我正确地看到了令牌:

<form action="/directory/create" method="post">
     <input name="_csrf" value="zN2jALCJ-K2cXntALNBMC9jfioHDuUJmpUks" type="hidden">

所以如果数据在会话中，html有csrf值作为隐藏字段，那么为什么这不起作用?是因为我的应用使用了多个路由路径吗

npm install --save body-parser

import bodyParser from 'body-parser';
app.use(bodyParser.urlencoded({
  extended: true
}));

<form action="/directory/create?_csrf=<%= _csrf %>" method="post">